NVD Vulnerability Detail

CVE-2021-3653

Summary	A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7.
Publication Date	Sept. 30, 2021, 5:15 a.m.
Registration Date	Sept. 30, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:22 p.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:9.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.html	Exploit Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.html	Exploit Third Party Advisory VDB Entry
3	https://bugzilla.redhat.com/show_bug.cgi?id=1983686	Issue Tracking Patch Third Party Advisory
4	https://bugzilla.redhat.com/show_bug.cgi?id=1983686	Issue Tracking Patch Third Party Advisory
5	https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html	Mailing List Third Party Advisory
6	https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html	Mailing List Third Party Advisory
7	https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html	Mailing List Third Party Advisory
8	https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html	Mailing List Third Party Advisory
9	https://www.openwall.com/lists/oss-security/2021/08/16/1	Mailing List Patch Third Party Advisory
10	https://www.openwall.com/lists/oss-security/2021/08/16/1	Mailing List Patch Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Linux Kernel における認証の欠如に関する脆弱性

Title	Linux Kernel における認証の欠如に関する脆弱性
Summary	Linux Kernel には、認証の欠如に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 19, 2021, midnight
Registration Date	April 13, 2022, 3:27 p.m.
Last Update	April 13, 2022, 3:27 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux

Debian

Debian GNU/Linux

Linux

Linux Kernel 5.14-rc7 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-3653	https://www.cve.org/CVERecord?id=CVE-2021-3653
National Vulnerability Database (NVD)
2	CVE-2021-3653	https://nvd.nist.gov/vuln/detail/CVE-2021-3653

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-862	https://cwe.mitre.org/data/definitions/862.html

ベンダー情報

No	Name	URL
Debian
1	[SECURITY] [DLA 2785-1] linux-4.19 security update	https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
2	[SECURITY] [DLA 2843-1] linux security update	https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
Linux Kernel
3	Linux Kernel Archives	http://www.kernel.org
Red Hat Bugzilla
4	Bug 1983686	https://bugzilla.redhat.com/show_bug.cgi?id=1983686

その他

No	Name	URL
関連文書
1	[CVE-2021-3653, CVE-2021-3656] SVM nested virtualization issues in KVM	https://www.openwall.com/lists/oss-security/2021/08/16/1

Change Log

No	Changed Details	Date of change
1	[2022年04月13日] 掲載	April 13, 2022, 3:27 p.m.